Bug in Bash Shell Creates Big Security Hole on UNIX/Linux
- Shameem Abdul Salam
- Linux , Security
- September 25, 2014
Table of Contents
A security vulnerability in the GNU Bourne Again Shell (Bash) — the command-line shell used in many Linux and Unix operating systems — could leave systems open to exploitation by specially crafted attacks.
The bug, discovered by Stephane Chazelas, is related to how Bash processes environmental variables passed by the operating system or by a program calling a Bash-based script. If Bash is configured as the default system shell, it can be exploited by network-based attackers against servers and other Unix and Linux devices via web requests, SSH, telnet sessions, or other programs that use Bash to execute scripts.
The vulnerability affects Bash versions 1.14 through 4.3. Patches were issued by major Linux distribution vendors for affected versions, including Red Hat Enterprise Linux, CentOS, and Ubuntu.
How to test your system
From a command line, run:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
If the system is vulnerable, the output will be:
vulnerable
this is a test
An unaffected (or patched) system will output something like:
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
What to do
Update Bash to a patched version. On most distributions, a blanket package update for Bash is the safest approach.
Because Bash is often used by Apache (CGI), OpenSSH, DHCP clients, and other services — not just interactive shells — this was a broad infrastructure issue, not just a desktop concern.
Originally published on LinfoPage.Com (September 2014). Source reference: Ars Technica coverage.
